Vendor
Ubuntu
6,629 known vulnerabilities in products by Ubuntu, 7 of them actively exploited (CISA KEV).
Key figures
6,629
Vulnerabilities
7
Actively exploited (KEV)
0
Used by ransomware
658
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2025-32463 | Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability In CISA KEV | 9.3 | |
| Critical | CVE-2025-68461 | RoundCube Webmail Cross-site Scripting Vulnerability In CISA KEV | 7.2 | |
| Critical | CVE-2021-3493 | Linux Kernel Privilege Escalation Vulnerability In CISA KEV | 8.8 | |
| Critical | CVE-2026-31431 | Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability In CISA KEV | 7.8 | |
| Critical | CVE-2026-53266 | Linux Kernel Out-of-Bounds Write Vulnerability In CISA KEV | 8.8 | |
| Critical | CVE-2025-38352 | Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability In CISA KEV | 7.8 | |
| Critical | CVE-2026-53362 | Linux Kernel Unspecified Vulnerability In CISA KEV | 7.8 | |
| Critical | CVE-2026-109618 | RCE via OOM corruption | 9.8 | |
| Critical | CVE-2026-109619 | RCE via stale global state | 8.1 | |
| Critical | CVE-2024-5535 | SSL_select_next_proto buffer overread | 9.1 | |
| Critical | CVE-2025-66516 | Apache Tika core: Improper Restriction of XML External Entity Reference | 8.4 | |
| High | CVE-2026-43284 | Linux Kernel: security vulnerability | 8.8 | |
| High | CVE-2025-3155 | Yelp: arbitrary file read | 7.4 | |
| Critical | CVE-2026-6949 | open source Samba: security vulnerability | — | |
| Critical | CVE-2026-58221 | open source Samba: security vulnerability | — | |
| Critical | CVE-2026-4480 | Samba: samba: remote code execution in printing subsystem via unescaped job description | 9.0 | |
| High | CVE-2026-77692 | Unauthenticated remote crash of named via a single DoH SIG(0) request | 7.5 | |
| High | CVE-2023-23969 | Django: Denial of Service | 7.5 | |
| High | CVE-2026-27654 | NGINX ngx_http_dav_module vulnerability | 8.2 | |
| High | CVE-2025-15467 | Stack buffer overflow in CMS (Auth)EnvelopedData parsing | 8.8 | |
| Critical | CVE-2026-42055 | NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability | 8.1 | |
| High | CVE-2026-61642 | Squid Request Smuggling in HTTP Transfer-Encoding | 7.7 | |
| High | CVE-2026-46242 | Linux Kernel: security vulnerability | 7.8 | |
| Critical | CVE-2025-37924 | Linux Kernel: Use-After-Free | 9.8 | |
| Critical | CVE-2026-41179 | Rclone: OS Command Injection | 9.8 |
News
- PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malwarethehackernews,
- PHP2Shell exposes the weakness in coordinated vulnerability disclosurecsoonline,
- Neutralizing PHP2Shell: Stopping Critical PHP RCEs with VMware vDefend and Avi WAFvmware-security,
- Two critical PHP flaws put the web on alert as emergency patches arrivecsoonline,
- PHP2Shell Patches Land as First Exploitation Attempts Hit Sensorssecurityweek,
- PHP ships emergency patches for critical PHP2Shell flawsbleepingcomputer,
Products
| Product | CVEs | Actively exploited |
|---|---|---|
| Linux-oracle-7.0 | 1,007 | 2 |
| Ubuntu Linux | 735 | 0 |
| Linux-oracle | 646 | 0 |
| Linux-ibm | 640 | 0 |
| Linux-realtime | 634 | 0 |
| Linux-aws | 627 | 0 |
| Linux-raspi | 608 | 0 |
| Linux-gcp-5.15 | 549 | 0 |
| Linux-gcp | 539 | 0 |
| Linux-gke | 533 | 0 |
| Linux-nvidia-tegra | 333 | 0 |
| Linux-raspi-realtime | 183 | 0 |
| Linux-nvidia-6.17 | 154 | 0 |
| Linux-azure-6.8 | 147 | 0 |
| Linux-aws-fips | 125 | 0 |
| Linux-hwe-7.0 | 109 | 0 |
| Linux-aws-7.0 | 101 | 0 |
| Linux-azure | 83 | 0 |
| Linux-azure-fde | 80 | 0 |
| Openssl | 71 | 0 |
| Aws | 68 | 0 |
| Aws-6.8 | 68 | 0 |
| Aws-hwe | 68 | 0 |
| Azure | 68 | 0 |
| Azure-4.15 | 68 | 0 |
| Gcp | 68 | 0 |
| Gcp-4.15 | 68 | 0 |
| Gcp-6.8 | 68 | 0 |
| Generic-4.15 | 68 | 0 |
| Generic-4.4 | 68 | 0 |
| Generic-5.4 | 68 | 0 |
| Gke | 68 | 0 |
| Hwe-6.8 | 68 | 0 |
| Ibm | 68 | 0 |
| Ibm-6.8 | 68 | 0 |
| Lowlatency-4.15 | 68 | 0 |
| Lowlatency-4.4 | 68 | 0 |
| Lowlatency-5.4 | 68 | 0 |
| Oracle | 68 | 0 |
| Linux-hwe-6.8 | 67 | 0 |
| Lowlatency | 65 | 0 |
| Ubuntu Linux | 64 | 0 |
| Mysql-8.0 | 51 | 0 |
| Mysql-8.4 | 51 | 0 |
| Linux-azure-fips | 44 | 0 |
| Linux-fips | 43 | 0 |
| Linux-gcp-fips | 40 | 0 |
| Qemu | 39 | 0 |
| Openssh | 38 | 0 |
| Ffmpeg | 35 | 0 |
| Linux-lowlatency | 35 | 0 |
| Linux-gkeop | 34 | 0 |
| Dotnet8 | 30 | 0 |
| Webkit2gtk | 30 | 0 |
| Dotnet10 | 28 | 0 |
| Dotnet11 | 28 | 0 |
| Freerdp3 | 26 | 0 |
| Bind9 | 25 | 0 |
| Curl | 25 | 0 |
| Erlang | 22 | 0 |